skills.rest
adrien-barret
adrien-barretCOMMUNITY
Explore all skills by this author →
𝕏@AtemisLabGitHub

auth-review

Audit authentication and authorization designs for security weaknesses.

8|4|Updated Feb 7, 2026
Search Tags:#authorization#authentication#RBAC#JWT#auth#security-review#ABAC
One-click install
npx skills add https://github.com/adrien-barret/claude-kit --skill auth-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth-review
Source: https://github.com/adrien-barret/claude-kit/tree/main/project-template/.claude/skills/security/auth-review
Command: npx skills add https://github.com/adrien-barret/claude-kit --skill auth-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security engineers review authentication and authorization design across codebases to identify weaknesses in token handling, session management, and access controls.

Core Features & Use Cases

  • Identify authentication mechanisms (JWT, OAuth, API keys) and how they are integrated.
  • Map token issuance, validation, and refresh flows; check for expiration handling and TTLs.
  • Assess authorization models (RBAC/ABAC) and ensure centralized checks; flag ad-hoc comparisons.
  • Detect potential privilege escalation risks and IDORs; review CSRF and cookie security settings.
  • Provide remediation guidance and prioritized risk mitigation for secure design.

Quick Start

Run a security review focusing on the auth layer by scanning for token lifetimes, session cookies, and authorization checks. Generate a concise report with findings and recommended mitigations.

Frequently Asked Questions about auth-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit JWT token lifetimes and session management in my codebase?▼

To audit JWT token lifetimes and session management, review token issuance, validation, and refresh flows to verify proper expiration handling, TTL enforcement, and secure cookie flags across your services.

What is the best way to check for RBAC and ABAC authorization weaknesses?▼

Checking RBAC and ABAC authorization weaknesses involves assessing access control models to ensure centralized checks, flagging ad-hoc comparisons, and detecting potential privilege escalation risks or IDORs.

How do I review OAuth integration and API key security for access control?▼

Review OAuth integration and API key security by identifying authentication mechanisms and mapping how they are integrated, ensuring secure key management and validating token issuance flows.

Does this security review cover CSRF protections and cookie security settings?▼

Yes, this security review covers CSRF protections and cookie security settings by systematically checking for proper cookie security flags and validating CSRF protection mechanisms across the auth layer.

How do I generate a risk assessment report for authentication design validation?▼

Generate a risk assessment report for authentication design validation by scanning the auth layer for token lifetimes, session cookies, and authorization checks, producing prioritized remediation guidance and risk mitigation.

Related Skills

Explore More Software Engineering Skills→
AdeptMindAdeptMind

auth-review

Review authentication and authorization designs for OAuth, JWT, and RBAC/ABAC vulnerabilities.

Official
Advanced
CuriousLearnerCuriousLearner
27

auth-analyzer

Analyze authentication and authorization patterns for security vulnerabilities against OWASP Top 10 and NIST.

Community
Advanced
gajjalaashok75-UIgajjalaashok75-UI
2

api-security-testing

Test REST and GraphQL APIs for authentication, authorization, and validation weaknesses.

Community
Advanced
zerx-labzerx-lab
62

gpui-event

Define, emit, and subscribe to type-safe events in GPUI components.

Community
Intermediate